Feeds

'Hacked' estate agency Foxtons breaks glass, pulls password reset cord

10,000 account logins feared leaked all over the web

Secure remote control for conventional and virtual desktops

Trendy UK estate agency Foxtons pushed the big red password reset button, as a precaution, after it appeared hackers lifted thousands of clients' usernames and passwords from its systems.

Miscreants claimed to have leaked online user names, email addresses and passwords of nearly 10,000 Foxtons’ customers, Estate Agent Today reports. The supposed logins to MyFoxtons web portal, some partially obscured, were uploaded to Pastebin.

The list was quickly pulled but the assumption has to be that copies were made before this happened. Anyone with access to the list, whose authenticity remains unconfirmed, may have been able to log into Foxtons' systems and access all sorts of sensitive information such as addresses, phone numbers and rent payment details. This wouldn't include credit card or bank details but it would still provide rich fodder for follow-up social engineering attacks.

In an advisory to customers on Tuesday, forwarded to El Reg by readers, Foxtons said it was investigating the purported hack. In the meantime it had reset user passwords as a precaution:

We have been able to download the list of usernames and passwords that were posted and are currently running checks to determine its veracity. Please be assured though that any sensitive information, including credit card information that you may have provided in relation to payments made through Foxtons is completely secure with our external payment providers.

Immediate action, however, has been taken to safeguard your account and an investigation will continue. Should your account be upon the list, you will be contacted directly by our Team.

Whilst this investigation is underway, we are unwilling to run the risk that any live MyFoxtons account is upon the list and have initiated a trigger to reset user passwords upon your next successful login. It is not necessary to do this straight away, just the next time you want to use the account.

We asked a Foxtons representative whether the company hashed or salted stored passwords, a basic security practice. The rep declined to comment on any aspects of the incident beyond saying that it may decide to issue a statement at some point.

Ross Parsell, director of cyber security at Thales UK, said that tighter regulation might be needed to stem the growing list of data breaches.

“The recent spate of high-profile data breaches, such as this alleged attack on Foxtons, are evidence that organisations are either not taking cyber security seriously or are bewildered by the problem. Regulation in this case is a necessity to alter corporate behaviour." ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.